One week is enough time to pass AZ-900 if you use it correctly. Most one-week plans fail because they're built around covering everything rather than targeting the right things. AZ-900 tests conceptual understanding, not configuration depth — you can learn what you need to know in seven focused days.
This plan assumes you're starting with no cloud background. If you have IT experience, you can cover the same ground in 3-4 days.
What You're Actually Preparing For
AZ-900 is a vocabulary and concepts exam. It does not require you to log into Azure, configure services, or write a single line of code. Every question tests one of three things:
What is this cloud concept? (shared responsibility model, SLA, CapEx vs OpEx)
What does this Azure service do? (what is Azure Blob Storage, what is Azure Functions, what is Azure AD)
Which Azure service solves this problem? (a company needs to X — which Azure service handles that)
Knowing the answer to "what does Azure Cosmos DB do?" is achievable in one week. Knowing how to configure Azure Cosmos DB is not required.
Exam basics:
40-60 questions, 85 minutes
Passing score: 700/1000
Question formats: multiple choice, multiple select, drag-and-drop, true/false, matching
Cost: $165
The Seven-Day Plan
Day 1: Cloud Concepts (2.5 hours)
Goal: Understand why cloud exists, what the shared responsibility model means, and the difference between service models.
Morning (1 hour): Microsoft Learn — "Describe cloud concepts" learning path. Read every module in the "Microsoft Azure Fundamentals: Describe cloud concepts" learning path. Don't skim — these concepts appear directly as exam questions.
Afternoon (1 hour): Key concepts to memorize:
Shared responsibility model — who is responsible for what:
| Layer | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Physical datacenter | Customer | Microsoft | Microsoft | Microsoft |
| Network hardware | Customer | Microsoft | Microsoft | Microsoft |
| Operating system | Customer | Customer | Microsoft | Microsoft |
| Runtime/middleware | Customer | Customer | Microsoft | Microsoft |
| Applications | Customer | Customer | Customer | Microsoft |
| Data | Customer | Customer | Customer | Customer |
CapEx vs OpEx:
CapEx (capital expenditure): large upfront costs, depreciated over time. On-premises servers are CapEx.
OpEx (operating expenditure): pay-as-you-go, monthly costs. Cloud services are OpEx.
Cloud advantage: no upfront CapEx, scale cost with actual usage.
Consumption-based model: you pay for what you use. Idle resources cost nothing (or minimal cost). This enables cost optimization that on-premises hardware doesn't allow.
Evening (30 min): Microsoft Learn knowledge checks. Take the knowledge checks for every module completed today. Review any you get wrong.
Day 2: Azure Architecture and Global Infrastructure (2.5 hours)
Goal: Understand Azure's geographic structure and how it affects availability.
Core concepts:
Regions: Azure has 60+ regions globally. A region is a geographic area containing one or more datacenters. When you deploy an Azure VM, you choose a region. Most Azure services are deployed within a specific region — your data stays in that region by default.
Region pairs: each Azure region is paired with another region at least 300 miles away. During Azure updates, paired regions are updated sequentially (not simultaneously) to minimize outage risk. Region pairs matter for disaster recovery.
Availability Zones: physically separate datacenters within a single region. Three zones per region (where supported). VMs deployed across availability zones get a 99.99% SLA. An availability zone failure doesn't affect other zones.
Availability Sets: logical groupings within a single datacenter. Spreads VMs across fault domains (different power/cooling) and update domains (different maintenance windows). Lower SLA (99.95%) than availability zones, but usable in regions without zone support.
Resource hierarchy: Management Group → Subscription → Resource Group → Resource. Permissions and policies applied at higher levels cascade down. A policy applied to a subscription applies to all resource groups and resources within it.
Study approach: draw this hierarchy on paper. Then draw the geographic hierarchy (region → availability zone → datacenter). Understanding these structures answers multiple exam questions.
Day 3: Core Azure Services — Compute and Networking (3 hours)
Goal: Know what each major compute and networking service does.
Compute services:
| Service | What it does | Key characteristic |
|---|---|---|
| Azure Virtual Machines | IaaS compute — you manage the OS | Most control, most responsibility |
| Azure App Service | PaaS web hosting — Microsoft manages OS | For web apps and APIs |
| Azure Container Instances | Run containers without managing infrastructure | Quick, simple container deployment |
| Azure Kubernetes Service (AKS) | Managed Kubernetes for container orchestration | For complex containerized apps |
| Azure Functions | Serverless code execution | Event-driven, billed per execution |
| Azure Virtual Desktop | Virtualized Windows desktops in the cloud | Remote work, VDI replacement |
Networking services:
| Service | What it does |
|---|---|
| Azure Virtual Network (VNet) | Private network in Azure — isolates resources |
| Azure Load Balancer | Distributes traffic across multiple VMs |
| Azure Application Gateway | Layer 7 load balancer with WAF capability |
| Azure VPN Gateway | Encrypted connection between Azure and on-premises |
| Azure ExpressRoute | Private dedicated connection (not internet-based) |
| Azure DNS | Domain name resolution service |
| Azure CDN / Azure Front Door | Content delivery and global load balancing |
Key distinction the exam tests: VPN Gateway vs ExpressRoute. VPN Gateway uses the public internet (encrypted). ExpressRoute is a private dedicated circuit — more expensive, more consistent, not routed through the internet.
Day 4: Core Azure Services — Storage and Databases (2.5 hours)
Storage services:
Azure Blob Storage: object storage for unstructured data. Three access tiers:
Hot: frequently accessed data (highest storage cost, lowest access cost)
Cool: infrequently accessed data (lower storage cost, higher access cost)
Archive: rarely accessed data (lowest storage cost, highest access cost, rehydration required)
Azure Files: managed file shares accessible via SMB protocol. Used to replace on-premises file servers.
Azure Queue Storage: message queue for decoupling application components.
Azure Disk Storage: managed disks for Azure VMs.
Database services:
| Service | Type | Key use case |
|---|---|---|
| Azure SQL Database | Relational (SQL Server) | Structured data, OLTP |
| Azure Cosmos DB | NoSQL, globally distributed | Global apps, flexible schema |
| Azure Database for MySQL | Relational (MySQL) | Open-source MySQL workloads |
| Azure Database for PostgreSQL | Relational (PostgreSQL) | Open-source Postgres workloads |
| Azure Synapse Analytics | Data warehousing | Analytics and reporting at scale |
The frequently tested distinction: Azure SQL Database is managed SQL Server — you don't manage the underlying OS or database engine. SQL Server on a VM is IaaS — you manage everything including the OS and SQL Server installation.
Day 5: Security, Identity, and Compliance (2.5 hours)
Identity and access:
Azure Active Directory (Azure AD / Entra ID): cloud-based identity service. Manages users, groups, and application access. Different from on-premises Windows Active Directory despite the name.
Multi-Factor Authentication (MFA): requires two or more forms of verification (something you know + something you have + something you are). Azure AD MFA is part of the Azure AD service.
Conditional Access: policies that control access based on conditions — location, device compliance, sign-in risk. "Require MFA when signing in from outside the corporate network" is a conditional access policy.
Security services:
| Service | What it does |
|---|---|
| Microsoft Defender for Cloud | Security posture management, threat detection |
| Azure Key Vault | Stores secrets, keys, and certificates securely |
| Azure Policy | Enforces organizational standards on resources |
| Azure Blueprints | Deploys compliant Azure environments |
| Microsoft Sentinel | SIEM and SOAR (Security information and event management) |
Compliance terms the exam uses:
Data sovereignty: data must remain in a specific geographic region
Data residency: related to data sovereignty — where data is physically stored
Privacy: user data protection obligations
Compliance: adherence to regulations (GDPR, HIPAA, PCI DSS)
Azure Trust Center and Microsoft Compliance Manager track compliance against frameworks.
Day 6: Pricing, Cost Management, and SLAs (2 hours)
Cost management tools:
| Tool | Purpose |
|---|---|
| Azure Pricing Calculator | Estimate cost before deploying |
| Azure TCO Calculator | Compare on-premises vs Azure costs |
| Azure Cost Management | Monitor actual spending, set budgets |
Factors that affect Azure cost:
Resource type and size
Region (prices vary by region)
Bandwidth (data transfer out is charged)
Subscription type
Cost optimization options:
Reserved Instances: commit to 1 or 3 years, save up to 72% vs pay-as-you-go
Spot VMs: use excess Azure capacity at up to 90% discount, can be evicted
Azure Hybrid Benefit: use existing Windows Server and SQL Server licenses in Azure
Azure Credits: free tier and credits for new accounts
SLAs:
SLA = Service Level Agreement — Microsoft's uptime commitment
Single VM with Premium SSD: 99.9%
Two VMs in Availability Set: 99.95%
Two VMs across Availability Zones: 99.99%
Composite SLA: multiple dependent services have SLAs that compound. Two services at 99.9% in series = 99.9% × 99.9% = 99.8%
Day 7: Practice Exam + Review (3 hours)
Morning (1.5 hours): Take the free Microsoft Learn AZ-900 practice assessment under timed conditions. Treat it as a real exam — no looking up answers while taking it.
Review every question:
For correct answers: confirm you understood why it was correct (not just lucky)
For wrong answers: identify which domain and concept the question tested
Group wrong answers by domain to find patterns
Afternoon (1.5 hours):
Revisit the domains where you got the most questions wrong
Re-read the relevant Microsoft Learn modules for those topics
Take another pass at knowledge checks
Exam readiness check: if you're scoring 75%+ on the practice assessment, you're ready. Book the exam.
If scoring 65-74%: identify your weakest domain and spend one more day on it before booking.
If scoring below 65%: extend study by 3-5 more days on your weakest areas before booking.
What Happens on Exam Day
Scheduling: book through Pearson VUE (testing center) or online proctored. Online proctoring allows you to take the exam at home with a webcam and microphone. Testing center provides a controlled environment without technical setup requirements.
Before the exam:
Review the shared responsibility model table one more time
Review the service comparison tables (compute, storage, database)
Get 8 hours of sleep — cognitive performance matters on knowledge exams
During the exam:
Read every question completely before looking at answer options
For "which service does X" questions: eliminate services that don't match the problem type first, then differentiate remaining options
Mark questions you're uncertain about and return to them
Use all available time — there's no benefit to finishing early
The format you'll see: a mix of multiple choice, multiple select (select all that apply), matching, and possibly drag-and-drop. Multiple select questions don't penalize for wrong selections in the same way multiple choice does — if you're unsure, pick the options that seem most likely.
Topics Within Each Domain That Get the Most Exam Questions
Cloud Concepts (25-30%): Where Candidates Lose Easy Points
The highest-frequency question types within this domain:
Shared responsibility model: appears in 3-5 questions per exam, always phrased as a scenario. "A company runs Azure Virtual Machines and needs to ensure the operating system security patches are applied. Who is responsible for this?" The answer is the customer — IaaS means you manage the OS. These questions are easy points for prepared candidates and lost points for candidates who haven't memorized the model tiers.
CapEx vs OpEx: appears in 2-3 questions. "A company wants to eliminate large upfront hardware investments and pay only for what they use. Which cloud characteristic addresses this?" The answer involves OpEx model and consumption-based pricing. Both terms appear in questions independently — know the difference cold.
High availability vs disaster recovery distinction: "A company wants to ensure their application remains available if one Azure data center fails" — that's Availability Zones (high availability within a region). "A company needs their application to remain available if an entire Azure region becomes unavailable" — that's geo-redundancy with region pairs (disaster recovery). These are tested separately.
Cloud economics terms: scalability (handle more load), elasticity (automatically scale up and down), agility (deploy resources quickly), geo-distribution (deploy worldwide), reliability (consistent performance with redundancy). The exam tests these definitions directly.
Azure Architecture (35-40%): The Most Dense Domain
This domain has the most questions and the widest topic coverage. Within it, these areas have the highest question density:
Compute service selection: candidates frequently miss questions about when to use Azure Functions vs Azure Container Instances vs App Service. The distinguishing characteristics: Azure Functions for event-driven code execution (billed per execution), App Service for web applications with predictable traffic (billed per plan hour), Container Instances for simple container deployment without orchestration. Know which is serverless (Functions), which is PaaS (App Service), which is somewhere between (Container Instances).
Storage tier selection: Hot vs Cool vs Archive access tier distinctions appear in 2-4 questions. The key numbers: Cool tier has a 30-day minimum storage requirement (charged even if deleted sooner), Archive requires rehydration before access. Questions phrase this as: "A company stores backup files that are rarely accessed but must be accessible within 24 hours when needed — which tier minimizes cost?" That's Cool, not Archive (Archive rehydration can take up to 15 hours).
Azure ExpressRoute vs VPN Gateway: this comparison appears consistently. The exam tests: "A company requires a consistent, dedicated private connection with guaranteed bandwidth to Azure." ExpressRoute. "A company needs to connect their on-premises network to Azure quickly and at low cost, and can accept variable internet-based connectivity." VPN Gateway.
Azure AD vs Azure AD DS: "A company needs to allow their on-premises application (which requires LDAP/Kerberos) to authenticate against a cloud-based directory without managing domain controllers." Azure AD DS (managed domain services), not standard Azure AD (which uses OAuth/OIDC, not LDAP/Kerberos).
Management and Governance (30-35%): The Highest Failure Rate Domain
This domain has the highest question failure rate because candidates study services but not governance tools.
Azure Cost Management vs Azure Pricing Calculator vs Azure TCO Calculator: candidates confuse these constantly.
Pricing Calculator: estimate cost BEFORE deploying (planning tool)
TCO Calculator: compare on-premises vs Azure total cost (migration business case tool)
Azure Cost Management: monitor ACTUAL spending of deployed resources (operational tool)
Questions give you a scenario (before deployment, during migration planning, monitoring existing costs) and ask which tool. The scenario context determines the answer.
Azure Policy vs RBAC: two complementary but distinct mechanisms. RBAC controls WHO can take actions on resources (John can create VMs, Sarah can only read them). Azure Policy controls WHAT configurations are allowed regardless of who is making the change (VMs must use managed disks, storage accounts must require HTTPS). The exam tests: "A company wants to prevent anyone from creating unencrypted storage accounts." That's Azure Policy (Deny effect), not RBAC.
SLA composite calculation: if the exam shows two services each with 99.9% SLA operating in sequence, the composite SLA is 99.9% × 99.9% = 99.8%. Questions may give you three services and ask which configuration achieves a specific composite SLA — requiring you to calculate or recognize which design meets the availability requirement.
What to Do If You're on Day 5 and Still Don't Feel Ready
By Day 5, you should be scoring 65-70%+ on knowledge checks. If you're below that, recalibrate before continuing.
Diagnosis step: take the Microsoft Learn AZ-900 practice assessment (free, 50 questions, no time limit for practice mode). Don't skip questions — force yourself to answer each one. After completing, look at which domains produced the most wrong answers.
If Cloud Concepts is your weakest area: go back to the shared responsibility model table and memorize it. Quiz yourself: for each layer (physical, network, OS, runtime, application, data), for each model (IaaS, PaaS, SaaS), who is responsible? This table answers 3-5 questions per exam.
If Azure Services is your weakest area: you probably tried to learn too many services superficially. Instead: learn 3 services per category deeply. For compute: VMs (IaaS), App Service (PaaS), Functions (serverless). For storage: Blob Storage (object), Azure Files (file shares), Queue Storage (messaging). For networking: VNet (isolation), Load Balancer (L4), Application Gateway (L7 with WAF).
If Governance is your weakest area: spend 2 hours specifically on Azure Policy vs RBAC, the three cost tools (what each is for), and SLA arithmetic. These are high-density topics with clean right/wrong answers.
Day 6 and 7 can absorb extra study: if you're feeling uncertain on Day 5, add a Day 6 focused entirely on your weakest domain. The exam doesn't expire — schedule it when you're ready, not because the calendar says Day 7.
Common Wrong Answers on AZ-900 and Why Candidates Choose Them
"Azure AD and Windows Server Active Directory are the same thing": candidates with Windows background assume Azure AD is just on-premises AD in the cloud. It isn't — different protocols (Azure AD uses OAuth/OIDC, not Kerberos/LDAP), different structure (no OUs, no Group Policy in Azure AD). Questions that depend on this distinction include: "A company needs to join VMs to a domain and apply Group Policy Objects" — this requires Azure AD Domain Services or a traditional domain controller, not plain Azure AD.
Confusing Availability Sets with Availability Zones: both provide high availability, but for different failure scenarios. Availability Sets protect against hardware failures within one datacenter (different fault domains). Availability Zones protect against entire datacenter failures (physically separate datacenters within a region). The question context determines which is correct — "protect against hardware failures" vs "protect against datacenter-level failure."
Selecting Archive for "infrequently accessed" data: Archive tier is for data that is RARELY (almost never) accessed and can wait hours for retrieval. "Infrequently accessed" with same-day retrieval requirements is Cool tier. The retrieval latency makes Archive wrong for many scenarios where it seems like the cheapest option.
Choosing Azure Monitor when Azure Cost Management is the answer: Azure Monitor tracks performance metrics and logs (CPU, memory, response times). Azure Cost Management tracks spending and billing. Questions about "monitoring cloud spending" or "identifying which resources cost the most" go to Azure Cost Management, not Azure Monitor.
Post-AZ-900 Next Steps by Career Direction
| Career Direction | Next Certification | Timeline After AZ-900 |
|---|---|---|
| Azure infrastructure / IT operations | AZ-104 Azure Administrator | 2-3 months study |
| Cloud development | AZ-204 Azure Developer Associate | 2-3 months study |
| Security and compliance | AZ-500 Azure Security Engineer (after AZ-104) | AZ-104 first, then 2-3 months |
| Cloud architecture | AZ-305 (requires AZ-104 first) | 6-12 months after AZ-900 |
| Data engineering | DP-900 Azure Data Fundamentals, then DP-203 | 1-2 months for DP-900 |
| AI/ML | AI-900 Azure AI Fundamentals, then AI-102 | 1-2 months for AI-900 |
| Sales or pre-sales | AZ-900 may be sufficient; consider role-specific Azure training | Stop at AZ-900 or add role training |
The most common mistake after AZ-900: treating it as a destination rather than a starting point. AZ-900 qualifies you for entry-level roles that require basic cloud literacy — help desk, sales support, project coordination on cloud projects. Technical roles (administrator, developer, architect, security engineer) require the corresponding associate or expert certification, not AZ-900 alone.
"Most of my students who take AZ-900 as their first certification tell me it gave them the vocabulary to have better conversations with their technical teammates. The ones who do best take AZ-900 seriously as a foundation, then move immediately to AZ-104 or AZ-204 based on their role. The ones who stop at AZ-900 often feel the certification didn't advance their career — and they're right, because they stopped too early." — John Savill, Microsoft MVP and creator of the Azure Master Class
References
Microsoft. Exam AZ-900: Microsoft Azure Fundamentals. Microsoft Learn, 2024. https://learn.microsoft.com/en-us/certifications/exams/az-900/
Microsoft. Microsoft Azure Fundamentals Learning Path. Microsoft Learn, 2024. https://learn.microsoft.com/en-us/training/paths/azure-fundamentals/
Savill, John. AZ-900 Azure Fundamentals Certification Study Cram — 2024 Edition. YouTube/NTFAQGuy, 2024. (Microsoft MVP; 3-hour free video review covering all AZ-900 domains)
Microsoft. Microsoft Learn AZ-900 Practice Assessment. Microsoft Learn, 2024. https://learn.microsoft.com/en-us/certifications/practice-assessments-for-microsoft-certifications (Free practice assessment with exam-style questions)
Washam, Michael, and others. Exam Ref AZ-900 Microsoft Azure Fundamentals. Microsoft Press, 2022. ISBN: 978-0137955145.
Pearson VUE. Microsoft Certification Exam Delivery. Pearson VUE, 2024. https://home.pearsonvue.com/microsoft (Official exam delivery partner; book AZ-900 through Pearson VUE)
Frequently Asked Questions
Can a complete beginner pass AZ-900 in one week?
Yes. AZ-900 tests cloud concepts and Azure service recognition, not configuration skills. With 2-3 focused hours per day across seven days, complete beginners can reach passing readiness. Candidates with IT backgrounds often need only 3-4 days.
What should I study on each day of AZ-900 preparation?
Day 1: cloud concepts (shared responsibility, CapEx vs OpEx, service models). Day 2: Azure geographic structure (regions, zones, availability sets). Day 3: compute and networking services. Day 4: storage and database services. Day 5: security, identity, and compliance. Day 6: pricing, cost management, and SLAs. Day 7: practice exam and gap review.
What is the passing score for AZ-900?
700 out of 1000. Microsoft uses scaled scoring, so 700 does not represent exactly 70% of questions correct. The exam has 40-60 questions with an 85-minute time limit. Multiple question formats appear: multiple choice, multiple select, drag-and-drop, true/false, and matching.
What is the single best free resource for AZ-900?
John Savill's AZ-900 Azure Fundamentals study cram on YouTube — approximately 3 hours, free, covers all exam domains with the precision of a Microsoft MVP who has taught it to thousands of candidates. Combined with the free Microsoft Learn AZ-900 practice assessment, this is a complete preparation path.
Should I take the exam online or at a testing center?
Both are valid. Online proctored exams through Pearson VUE allow you to test from home with a webcam and microphone — convenient but requires a quiet, clear room. Testing centers provide a controlled environment without home setup requirements. First-time exam takers often prefer testing centers to eliminate technical anxiety.